T05 · Unauthorized Access and Privilege Escalation
Error
- Location
services/graph_server.py:786- Finding
Unauthenticated Graph Management Server Exposed on All Network Interfaces
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenPaperGraph
Security checks for vulnerabilities and agentic risk
Overview
This literature tool is mostly purpose-aligned, but its interactive server exposes unauthenticated persistent graph editing beyond localhost and it can send research data to external services.
Review before installing: avoid running the serve mode on shared or untrusted networks, keep backups of graph JSON files, do not process sensitive unpublished PDFs or private libraries unless you are comfortable with external API and LLM transmission, and install dependencies in a controlled environment with pinned versions where possible.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
services/graph_server.py:88- Finding
Unbounded HTTP Request Bodies and PDF Uploads Permit Resource Exhaustion
- Content
View full analysis
- Remediation
View remediation
MAX_JSON_SIZE: self._json_response({"status": "error", "message": "Request too large"}, 413) return None ``` 3. Stream PDF uploads into a temporary file in fixed-size chunks while maintaining a running byte count; abort and delete the file when the maximum is exceeded. 4. Validate the PDF signature and apply page-count, decompressed-size, and parsing-time limits before full processing. 5. Set socket read timeouts to prevent slow-request resource exhaustion. 6. Limit concurrent PDF parsing and graph-expansion jobs with a bounded worker pool or semaphore. 7. Add authentication and loopback-only binding as described in the network-exposure finding. 8. Ensure temporary files are removed on all validation and exception paths. ]]>
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unpinned Runtime Dependencies Create a Mutable Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (89)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill’s stated purpose is literature discovery, but it also supports generic LLM provider selection, provider diagnostics, and outbound requests to many third-party LLM APIs. That capability expansion increases data-exfiltration and policy risk because user-provided graph contents, summaries, or document-derived text may be sent to external providers not implied by the primary description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill’s stated purpose is literature discovery, but it also supports generic LLM provider selection, provider diagnostics, and outbound requests to many third-party LLM APIs. That capability expansion increases data-exfiltration and policy risk because user-provided graph contents, summaries, or document-derived text may be sent to external providers not implied by the primary description.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The code clearly has network capability beyond passive local graph management: it searches external APIs, downloads PDFs, queries citation services, and calls an LLM fallback. If those network operations are not covered by declared permissions, the skill can transmit user-provided titles, BibTeX, PDF-derived content, and graph metadata externally without proper authorization or operator awareness.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The code clearly has network capability beyond passive local graph management: it searches external APIs, downloads PDFs, queries citation services, and calls an LLM fallback. If those network operations are not covered by declared permissions, the skill can transmit user-provided titles, BibTeX, PDF-derived content, and graph metadata externally without proper authorization or operator awareness.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh # Remove old installation (copy or broken symlink) if [ -e "$target_dir/SKILL.md" ] || [ -L "$target_dir/SKILL.md" ]; then rm -f "$target_dir/SKILL.md" info "Removed old installation" fi # Also remove legacy flat file if it exists
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh fi # Also remove legacy flat file if it exists if [ -e "$HOME/.claude/commands/opg.md" ] || [ -L "$HOME/.claude/commands/opg.md" ]; then rm -f "$HOME/.claude/commands/opg.md" info "Removed legacy opg.md" fi
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README promotes workflows that save outputs and operate on local files, but in the early feature overview it does not clearly warn users that graph creation, exports, and later interactive operations write data to disk and may modify existing files. In an agent-executed skill context, this matters because users may invoke commands through natural language without realizing the tool persists artifacts or changes local research data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The browser UI states that all mutations are saved to the JSON file immediately, but it does not clearly warn about overwrite, corruption, or accidental data-loss risk for the backing file. Because this is a persistent interactive server used by an agent-oriented skill, users may assume edits are reversible when they are not, increasing the chance of unintended destruction or silent modification of research data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
该 markdown 文件描述了
serve模式下“所有操作立即写入 JSON 文件”和“刷新页面后更改均已保存”，但未在命令说明或快速开始处给出显式用户警告，提醒这会直接修改本地文件。由于该行为会影响用户数据且包含添加、转化、删除等变更，仅靠功能描述不足以构成清晰的安全提示。- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest says to use the skill when a user asks about 'finding papers, literature review, citation analysis, research trends, or visualizing citation networks.' Several of these triggers, especially 'literature review' and 'research trends,' are broad everyday research requests without clear boundaries on when this skill should or should not activate.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest omits that the skill can start a persistent local HTTP server with browser-based editing and immediate writes to the graph JSON file. Hidden server exposure and persistent mutation are relevant security properties because they expand the attack surface and can surprise users or agents that expect a read/analyze/export-only workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The markdown describes a local server that persists edits to disk but does not present an explicit user warning about network exposure and automatic file modification. In an agent setting, lack of warning increases the risk of accidental server startup or unreviewed persistent changes, especially when users expect analysis rather than hosting/editing.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description understates destructive editing features such as removing papers/seeds and overwriting graph files. Even if intended, file-destructive operations are security-relevant because an agent may invoke them without the user realizing they are irreversible or that they alter existing data in place.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The removal commands overwrite graph files and delete content without a strong user-facing warning. In a tool likely to be used by autonomous or semi-autonomous agents, missing warnings around destructive operations make accidental data loss more likely and can turn ordinary prompts into irreversible changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The
_llm_extract_referencespath extracts text from uploaded/downloaded PDFs and sends up to 12,000 characters to an external LLM service without any user-facing warning or consent in this file. Academic PDFs can contain unpublished drafts, licensed content, or sensitive annotations, so silent transmission to a third party creates confidentiality and compliance risk.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The metadata enrichment flow reads
S2_API_KEYfrom the environment and performs external HTTP requests to Semantic Scholar without any explicit disclosure in this file. While expected for a literature-discovery skill, it still means user-supplied or graph-derived paper identifiers are sent to a third party and hidden credential use occurs outside an obvious consent boundary.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The summary command can route graph contents to an external LLM provider after setting provider/model from arguments, but the CLI does not clearly warn that paper metadata, abstracts, and graph-derived research structure may leave the local environment. In this skill context, literature graphs may include sensitive unpublished PDFs, curated collections, or proprietary topic mappings, making undisclosed third-party transmission materially risky.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The Zotero command accepts an API key and imports library contents, which necessarily transmits sensitive credentials and reading-library metadata to external services and internal service handlers without any explicit privacy or consent warning in the CLI flow. In a research-assistant skill, bibliographic libraries can reveal unpublished work, interests, collaborators, or institutional activity, so silent transmission increases privacy and secret-handling risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
When --summary is used during HTML export, the command pre-generates a summary from graph data via an LLM provider and embeds the result into the HTML, but the user is not clearly warned that graph contents may be sent to a third party first. Because this tool processes academic PDFs, citation networks, and research summaries, the exported data may encode sensitive research interests or unpublished references, so hidden external processing is a meaningful privacy issue.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest describes literature discovery, citation analysis, summaries, imports, exports, and HTML visualization, but this file also exposes an interactive server plus
remove-seedandremove-papercommands that modify stored graph files. Those graph-management operations are not disclosed in the stated skill description and expand behavior from analysis/visualization into persistent editing and serving.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The LLM summary path constructs a prompt containing titles, authors, years, citation counts, and up to 300 characters of each abstract, then sends it to an external provider via llm_chat. In an academic research tool, abstracts and bibliographic metadata are usually less sensitive than direct personal secrets, but unpublished, proprietary, licensed, or user-curated paper collections may still be exposed to third parties without an explicit disclosure or consent gate at the point of transmission.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The LLM fallback sends up to 3000 characters of first-page PDF text to an external model service, which can contain unpublished research, author PII, affiliations, emails, grant details, or other sensitive content. In a literature-analysis skill, users may reasonably expect local parsing of PDFs; silent transmission to a third-party LLM creates a real privacy and data-handling risk even though it is not arbitrary code execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code extracts substantial text from a local PDF and sends it to an external LLM service via llm_chat without any consent gate, sensitivity check, or user-visible disclosure at this call site. In a literature tool, uploaded PDFs may contain copyrighted, unpublished, or confidential material, so silent transmission to a third party creates a real privacy and data-governance risk.
- Content
Static analysis
No suspicious patterns detected.